The vulnerability is a classic SQL injection flaw (CWE‑89) that allows an attacker who is able to authenticate to the IBM API Connect service to inject arbitrary SQL commands through untrusted input fields. The flaw can lead to the extraction of database contents and thus sensitive data including credentials, configuration information, and other privileged data stored in the backend database. The impact is a full compromise of data confidentiality, and potentially integrity, for all data accessed by the affected API endpoints.

Affected versions are IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. The recommendation is to move to 10.0.8.13 or 12.1.1.3, which contain the documented fix.

The CVSS score of 9.6 indicates critical severity, but the EPSS score is not available and the vulnerability is not currently listed in the CISA KEV catalog, suggesting no confirmed active exploitation yet. The attack requires remote authenticated access, which usually means an attacker must first compromise valid user credentials or abuse mis‑configured permissions. Once authenticated, the attack vector is the public API service of API Connect, where SQL injection can be performed on parameterized API calls that forward data to the underlying database.